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(54) Monitoring of individual internet usage 

(57) Disclosed is a device and method in which the 
on-line activities of an on-line user are monitored and 
stored. Information regarding the user's activities are 
used as a basis for targeting advertisements to the user. 
Monitoring is performed by a client monitoring applica- 
tion, which performs monitoring without intruding on the 
user's activities. According to one aspect of the inven- 
tion, URLs in the address bar of the browser application 



are obtained by the client monitoring application. 
According to another aspect of the invention, the stream 
of URLs transmitted by the browser application are 
obtained by the client monitoring application. According 
to another aspect of the invention, information in dis- 
played web pages is obtained by the client monitoring 
application. 
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Description 

NOTICE OF COPYRIGHTS AND TRADE DRESS 

[0001] A portion of the disclosure of this patent doc- 
ument contains material, which is subject to copyright 
protection. This patent document may show and/or 
describe matter, which is or may become trade dress of 
the owner. The copyright and trade dress owner has no 
objection to the facsimile reproduction by any one of the 
patent disclosure, as it appears in the Patent and Trade- 
mark Office patent files or records, but otherwise 
reserves all copyright and trade dress rights whatso- 
ever. 

RELATED APPLICATION INFORMATION 

[0002] This application is related to Application No. 
09/265,512 filed March 9, 1999 entitled "Network Data 
Distribution Based Upon User-Specific Qualities," which 
is incorporated herein by reference, and which is a con- 
tinuation-in-part of Application No. 60/077,331 filed 
March 9, 1998 entitled 'Network Data Distribution 
Based Upon Geographic Location, Usage Patterns, 
Interactive Data, Profile Data, Demographic Data and 
Scheduling Information." 

BACKGROUND OF THE INVENTION 

1. Field Of The Invention 

[0003] The present invention relates to monitoring 
the activity of a user of a data network, such as the 
Internet. 

2. Description Of Related Art 

[0004] Online services today offer a variety of serv- 
ices to their users. Users may access news, weather, 
financial, sports, and entertainment services, partici- 
pate in and retrieve information from online discussion 
groups, and send and receive email. A user of an online 
service typically accesses the service using specialized 
communication software (i.e., client application or client 
software) that establishes and manages a connection 
from the user's computer (or client) to the service pro- 
vider's host computers (or servers) and facilitates the 
user's interactions with the service. 
[0005] In addition to managing the connection, 
there is provided software to display pages or screens 
relating to retrieved content according to views or pres- 
entations specific to the online service. This software 
may be integrated with the client application. The func- 
tionality of the content and the user interface (i.e., icons, 
dialog boxes, menus, etc.) for interacting with the con- 
tent are typically dictated by various standards. 
[0006] Interactions between the user's computer 
and the service are facilitated by a variety of software 



protocols (i.e., communication conventions, rules and 
structures), including application level protocols, for 
managing the transfer of data across the network and to 
the client application on the user's computer. A protocol 

5 may be proprietary or exclusive to a service such that 
only client software from the service provider may be 
used to communicate with the server software. For 
example, an online service that supports electronic 
mail, discussion groups, chat groups, news services, 

70 etc. may define and use specific protocols for each type 
of service so that appropriate information is exchanged 
between the participants (i.e., clients and servers). 
Each application-specific protocol may be based on a 
common, underlying protocol. 

is [0007] The Internet and World Wide Web ("web"), 
comprised of a vast array of international computer net- 
works, provide online service users with considerable 
information resources and other content. Typically, this 
content is accessed using a web browser, such as 

20 Microsoft Internet Explorer or Netscape Navigator, 
capable of understanding the HyperText Markup Lan- 
guage (HTML) used to create the documents found on 
the web and the HyperText Transfer Protocol (HTTP) 
used to navigate the web. Email and Usenet discussion 

25 groups are typically accessed through companion soft- 
ware to the browser. Although web browsers typically 
have varying levels of functionality or sophistication, 
retrieved content is displayed in content pages accord- 
ing to views or presentations specific to the web docu- 

30 ment currently presented by the web browser. Typically, 
the views and presentations are different than those 
provided by the communication software from the online 
service because the web browser is, in fact, a separate 
client application displaying web documents containing 

35 presentation directives. 

[0008] When using a browser, the browser issues 
HTTP messages to request web pages. A requested 
web page is typically identified using its URL — uniform 
resource locator. The URL is a reference (or address) to 

40 a resource available on a TCP/IP network such as the 
Internet. A URL is composed of a character string, and 
may have a number of parts. These parts include a top 
level domain name, second level domain name, direc- 
tory name, and file name. URLs may identify a file 

45 located on a web server. URLs may also point to other 
resources on the network such as database queries 
and command output. The determination and use of 
URLs is well known in the art and is not discussed fur- 
ther herein. 

so [0009] In some portions of this disclosure, the term 
"resource locator" is used. The term is defined as a 
string or code which uniquely identifies a resource on a 
network. Thus, the URL is a species of resource locator. 
[0010] There are a number of ways that a user can 

55 connect to the Internet. First, a user can subscribe to a 
proprietary on-line network, such as, for example, 
America Online. Second, a user can subscribe to an 
Internet Service Provider (ISP). In any case, users typi- 
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cally connect to the Internet using a computer with a 
communications device such as an analog modem, an 
Ethernet adapter, DSL adapter or cable modem. Such 
connections may be analog or digital, dial-up or con- 
stantty-co n nected . 

[0011] Subscribers typically pay a fee for their sub- 
scriptions to proprietary non-line networks and ISPs. 
These fees typically are in the form of a sign-up fee, plus 
on-line charges which are fixed (i.e., unlimited monthly 
access for a fixed fee) or based upon the amount of time 
the user is connected. The fees generally increase with 
bandwidth. 

[001 2] There are at least three ways in which the cli- 
ent monitoring application 110 can obtain information 
about the individuals' use of his browser: (1) by monitor- 
ing URLs in the address bar of the browser application 
160, (2) by monitoring the stream of URLs transmitted 
by the browser application 160 to the data access net- 
work 120, and (3) by grabbing information from the 
browser application's display pane 210. Each of these 
three techniques is described below in turn with refer- 
ence to Figure 5. 

[0013] On-line and Internet content and service 
providers often derive revenue by displaying advertise- 
ments to users. For example, when a user accesses a 
web page on the Web, an advertisement may be dis- 
played to the user as part of the web page. Advertise- 
ments are also shown to users of some proprietary on- 
line services. Often in such systems, each user access- 
ing a certain screen or site is shown the same adver- 
tisement. Sophisticated systems have the capability to 
change the advertisement after a certain period of time. 
[0014] Advertisers find it desirable to target adver- 
tisements to relevant potential customers. For example, 
an advertiser of stockings would prefer to target women 
rather than men with its advertising. A Boston restau- 
rant would prefer to target residents of Boston and busi- 
ness travelers rather than children living in San 
Francisco. Moreover, advertisers preferto pay for adver- 
tising based upon the number of relevant consumers 
who are actually exposed to the advertisement. For typ- 
ical on-line systems and networks, including the Web, it 
is often difficult for an advertiser to precisely determine 
whether its advertisements were actually viewed by a 
user and for how long, and whether the advertisement 
induced a response. Accordingly, there exists a need for 
a targeted advertisement system that also can provide 
information as to the characteristics of those who were 
exposed to each advertisement, for how long the user 
was exposed, and at what times. 

SUMMARY OF THE INVENTION 

[001 5] In accordance with the present invention, the 
on-line activities of an on-line user are monitored and 
stored. Information regarding the user's activities are 
used as a basis for targeting advertisements to the user. 
Monitoring is performed by a client monitoring applica- 



tion, which performs monitoring without intruding on the 
user's activities. 

[0016] According to one aspect of the invention, 
URLs in the address bar of the browser application are 

5 obtained by the client monitoring application. According 
to a second aspect of the invention, the stream of URLs 
transmitted by the browser application are obtained by 
the client monitoring application. According to a third 
aspect of the invention, information in displayed web 

io pages is obtained by the client monitoring application. 
[0017] Still further objects and advantages attach- 
ing to the system and to its use and coperation will be 
apparent to those skilled in the art from the following 
particular description. 

15 

DESCRIPTION OF THE DRAWINGS 

[0018] Further objects of this invention, together 
with additional features contributing thereto and advan- 
ce tages accruing therefrom, will be apparent from the fol- 
lowing description of a preferred embodiment of the 
present invention which is shown in the accompanying 
drawings with like reference numerals indicating corre- 
sponding parts throughout and which is to be read in 
25 conjunction with the following drawings, wherein: 

Figure 1 is a first block diagram of a network data 
distribution system in accordance with the inven- 
tion. 

30 Figure 2 is a second block diagram of a network 
data distribution system in accordance with the 
present invention. 

Figure 3 is a flow chart of a method of distributing 
data in a network in accordance with the invention. 
35 Figure 4 is a flow chart of a method of monitoring 

web browsing by a user in accordance with the 
invention. 

Figure 5 is a screen shot of a second window dis- 
played by a browser application. 
40 Figure 6 is a screen shot of a third window dis- 
played by a browser application. 
Figures 7A, 7B and 7C are flow charts of several 
techniques for obtaining information about a 
requested web page in accordance with the inven- 
ts tion. 

[0019] These and additional embodiments of the 
invention may now be better understood by turning to 
the following detailed description wherein an illustrated 
so embodiment is described. 

DETAILED DESCRIPTION OF THE INVENTION 

[0020] Throughout this description, the preferred 
55 embodiment and examples shown should be consid- 
ered as exemplars, rather than limitations on the appa- 
ratus and methods of the present invention. 
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The System of the Invention 

[0021] The system of the invention enables data to 
be sent to individuals based upon: the individual's geo- 
graphic location; the individual's interactive data; the 
individual's network usage data; the individual's per- 
sonal profile information; the scheduling requirements 
of the data to be sent; and the demographic require- 
ments of the data to be sent. 

[0022] Referring now to Figure 1 , there is shown a 
block diagram of a network data distribution system in 
accordance with the invention in conjunction with a 
source of web pages. Figure 1 includes a local device 
100, a data access network 120, a monitoring server 
130 and a web server 150. The local device 100, the 
data access network 1 20 and the monitoring server 1 30 
comprise the network data distribution system . 
[0023] The local device 1 00 preferably comprises a 
client computer which is configured to access the moni- 
toring server 130 via the local access network 120. The 
client computer may be, for example, a PC running a 
Microsoft Windows operating system. The local device 
100 preferably includes an output device, such as dis- 
play 101, and an input device, such as keyboard 102 
and / or pointing device 103 (e.g., mouse, track ball, 
light pen, or data glove). The local device 100 may also 
be, for example, an Internet appliance, network compu- 
ter (NC), or an appropriately Internet-enabled device 
such as a portable digital assistant (PDA), mobile 
phone, refrigerator, etc. The particular type of device of 
the local device 1 00 is not considered to be important 
so long as the local device 1 00 provides some measure 
of individual user interactivity with a source of web 
pages. 

[0024] The data access network 1 20 provides lower 
layer network support for the local device 1 00 to interact 
with the monitoring server 130 and the web server 150. 
The data access network 120 preferably comprises a 
common or private bi-directional telecommunications 
network (e.g., a public switched telephone network 
(PSTN), a cable-based telecommunication network, a 
LAN, a WAN, a wireless network), coupled with or over- 
layed by a TCP/IP network (e.g., the Internet or an 
intranet). 

[0025] The web server 150 may be of the type 
known in the art and has the ability to serve web pages 
to the local device 100, as requested in the manner 
known in the art. It should be appreciated that the web 
server 1 50 is generic for any source of web pages avail- 
able to the local device 100. Thus, for example, the web 
server 150 could be accessible from the Internet, or it 
could be a part of an intranet and represents any 
number of web servers. 

[0026] The monitoring server 130 preferably is a 
computer system, such as a server computer. The mon- 
itoring server 130 acts as a recipient of certain informa- 
tion transmitted by the local device 100, as described 
further below. The monitoring server 1 30 preferably also 



transmits certain data to the local device 100 as 
described further below. 

[0027] A browser application, such as Microsoft 
Internet Explorer or Netscape Navigator is preferably 

5 installed on the local device 100. When the local device 
100 is connected to the web server 150 through the 
data access network 120, the user of the local device 
browses the web server 150 from the local device 100 
using the browser application. The browser application 

10 itself need not be stored on the local device 100. The 
important aspect is that the user, from the local device 
100, can exercise control over what web pages are 
requested and thus displayed by the local device 100. 
[0028] Referring now to Figure 2, there is shown a 

15 window 400 generated by a browser application, here 
Microsoft Internet Explorer. The browser window 400 is 
familiar to those skilled in the art, so the particulars are 
not described further herein. Further information 
regarding the use of most browser applications and 

20 their technical specifications is abundantly available. 
[0029] Several aspects of the browser window 400 
are identified for further reference below. These aspects 
include a display pane 410, an address bar 420 and a 
title bar 430. The display pane 410 is a region of the 

25 browser window 400 wherein the browser application 
causes web pages received by the browser application 
to be displayed. The address bar 420 is another region 
of the browser window 400 and the browser application 
displays URLs in the address bay 420 corresponding to 

30 the web page currently displayed in the display pane 
41 0. The user can also enter a URL into the address bar 
420, and the browser application will attempt to load the 
web page or other object to which the entered URL 
points. The primary feature of the title bar 430 is that it 

35 displays the title of the browser application. Another fea- 
ture of most browsers is that the title bar 430 displays 
the title of the web. page then displayed in the display 
pane 410. 

[0030] Some browser applications permit the 

40 address bar to be hidden. However, even if the address 
bar is hidden, the browser application will copy the URL 
of a requested web page into an object corresponding 
to the displayed address bar. For this reason, refer- 
ences herein to the term "address bar" refers either the 

45 address bar display 420 or the address bar object, 
depending on the context. One of skill in the art will 
appreciate the proper meaning of the term depending 
on its context. However, in general, the address bar dis- 
play is indicated with its reference number, 420. 

so [0031] Referring now to Figure 3, there is shown a 
block diagram of a network data distribution system in 
accordance with the present invention. The system 
comprises a client monitoring application 110, the data 
access network 120, the monitoring server 130 and 

55 data stores 140a-g (collectively, 140). A browser appli- 
cation 1 60 is also shown. The client monitoring applica- 
tion 1 1 0 is a program operative on local device 1 00, and 
preferably an independent application program or a 
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DLL. The client monitoring application 110 preferably 
retrieves certain network data, displays certain network 
data, transmits geographic location data, transmits 
interactive user data, transmits network usage data and 
transmits personal profile information as described 5 
above. The client monitoring application is preferably a 
fully-featured client application which also sets up and 
maintains the connection to the data access network 
120. The data stores 140 store and provide this geo- 
graphic information data 140d, network usage data to 
140a, interactive usage data 140b, personal profile 
information 140g, data to be sent 140e, schedule for 
transmitting data 140f and demographics for transmit- 
ting data 140c. 

[0032] Each time an individual uses the local device is 
1 00 to connect to the data access network 120, the cli- 
ent monitoring application 110 and the monitoring 
server establish a session, in this session, the client 
monitoring application 1 1 0 transmits certain information 
regarding the user of the local device 1 00 and his use of 20 
the local device 1 00 while connected to the data access 
network 120. The monitoring server 130, on the other 
hand, uses the information from the client monitoring 
application 100 to determine information which should 
be sent to the client monitoring application 1 1 0. Prefer- 25 
ably, the information from the client monitoring applica- 
tion 1 10 is used by the monitoring server 130 to select 
advertisements to the local device 1 00. The client mon- 
itoring application then causes these advertisements to 
be displayed on the local device's output device 101. 30 
[0033] The information from the client monitoring 
application 1 1 0 regarding the user preferably includes 
geographic data and personal profile information. Geo- 
graphic data indicating the user's current location pref- 
erably is sent from the client monitoring application 110 35 
to the monitoring server 130, which then stores the geo- 
graphic data in the data store 140d. This geographic 
data can be something simple, like a phone number. 
The user preferably provides personal profile informa- 
tion on a periodic basis which is stored in the data store 40 
140g and used by the monitoring server 130. This infor- 
mation consists of (but is not limited to) things such as: 
age, sex, marriage status, home address and personal 
interests. 

[0034] The information regarding the user's use of 45 
the local device 100 includes email and web usage and 
advertisement click-throughs. The user's interactions 
and feedback with the web server 1 50 provided through 
the browser application 1 60are preferably captured by 
the client monitoring application 110, analyzed by the so 
monitoring server 1 30 and stored in the data store 1 40b. 
This includes the user's feedback and responses to the 
data delivered to the browser application 160. The 
user's activities on the web server 150 provided through 
the browser application 160 are preferably captured by 55 
the client monitoring application 110, analyzed by the 
monitoring server 130 and stored in the data store 
140a. This includes the type of network data the users 



requests and accesses. This data is preferably summa- 
rized and classified into multiple demographic profiles. 
[0035] The data to be sent to users preferably has 
scheduling requirements that dictate when it should be 
sent. These scheduling requirements include (but are 
not limited to): frequency, maximum number of times to 
send to an individual, minimum number of times to send 
to an individual, time of day to send, and first and last 
days to send. The data to be sent to users can have 
demographic requirements that dictate to whom it 
should be sent. These include (but are not limited to): 
personal profile, interactive data, network usage infor- 
mation and geographic location. 

The Methods of the Invention 

[0036] Referring now to Figure 4, there is shown a 
flow chart of a method of distributing data in a network 
in accordance with the invention. The components 1 10, 
120, 130, 140 work together to deliver data that meets 
the geographic and demographic criteria. 
[0037] After the method begins (step 405), the user 
preferably uses the client monitoring application 1 10 to 
connect to the data access network 120, and then the 
monitoring server 130 (step 41 0). If this is the first time 
the user has connected (step 415), then the user is 
required to submit personal profile information (step 
420). Preferably, the monitoring server 130 periodically 
will request (step 425) that the client monitoring applica- 
tion 110 have the individual update this profile (step 
430). Each time the local device 100 connects to the 
monitoring server 130, the client monitoring application 
110 preferably sends data indicating the local device's 
current geographic location to the monitoring server 130 
(step 435). 

[0038] Once connected, a number of processes are 
started (step 440). In one of these processes, whenever 
the user interacts with data received on the client moni- 
toring application 1 10, the client monitoring application 
110 sends feedback information respecting this interac- 
tion to the monitoring server 1 20. The monitoring server 
120 then summarizes and classifies the feedback infor- 
mation into multiple demographic profiles, and stores 
these profiles in the data store 140. 
[0039] In another of these processes, whenever an 
individual uses the browser application 160 to request 
or access data from the web server 1 50, the client mon- 
itoring application 110 sends feedback information 
respecting these requests and data accesses to the 
monitoring server 130. The monitoring server 130 then 
summarizes and classifies this feedback information 
into multiple demographic profiles, and stores these 
profiles in the data store 140. 

[0040] In another of these processes, while a user's 
local device 100 is connected to the web server 150, the 
monitoring server 130 determines which targeted data 
needs to be sent to the client monitoring application 1 1 0 
and then transmits this targeted data to the client moni- 
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toring application 110. The monitoring server 130 
accomplishes this by: 

examining the scheduling requirements to deter- 
mine which data needs to be sent; 5 

examining the demographic requirements of the 
data to determine to which demographic profiles 
the data needs to be sent; 

10 

selecting the users who are currently connected 
that meet the demographic requirements of the 
data; and 

sending the data to the selected users. 15 

[0041] As mentioned, one of the processes relates 
to the user's use of his browser application 160. 
[0042] In the first step of the method, the client 
monitoring application 110 is activated on the local 20 
device 100 (step 510). The client monitoring application 
100 may be installed during manufacture of the local 
device 100, during use of the local device 100 at the 
instigation of the user, or may occur automatically as a 
consequence of other processes. Although at (east 25 
some aspects of the client monitoring application 110 
should be operable from the local device 100, the client 
monitoring application 100 need not be not stored on 
the local device 1 00 and can be run from a remote loca- 
tion. 30 
[0043] In the next step of the method, the browser 
application 160 is activated on the local device 100 
(step 515). The browser application 160 may be acti- 
vated manually, or automatically by a script or through 
commands issued by the client monitoring application 35 
110. It should be appreciated that the browser applica- 
tion 1 60 may be activated prior to activation of the client 
monitoring application 110, though in such a case, the 
functionality of the client monitoring application 110 will 
not be available as described below with respect to 40 
grabbing URLs from the address bar 220. 
[0044] tn the next step, the user requests that the 
browser application 160 display a desired web page 
(step 520). This may occur in at least three different 
ways, which are discussed with reference to Figure 6. 45 
Figure 6 shows tne browser window 200 with a web 
page 61 0. The address bar 220 displays the URL for the 
displayed web page 610, www.arterhad- 
den.com/alpha.htm. The displayed web page 610 
includes a number of common features to web pages, so 
These features are hyperlinks such as hyperlink 620, 
buttons such as button 630, and data entry fields such 
as data entry field 640. Those of ordinary skill in the art 
appreciate the design of web pages and the functional- 
ity of hyperlinks, buttons and data entry fields, so these 55 
features are not described further herein. 
[0045] One way for the user to request that the 
browser application display a desired web page is to 



10 

enter a URL into the address bar 220. For example, to 
display the web page 610, the user could use the key- 
board 102 to type the URL w ww. arte rh ad- 
den. com./alpha. htm into the address bar 220. 
Alternatively, the user could paste the URL into the 
address bar 220, or use automated means such a 
script. 

[0046] A second way for the user to request that the 
browser application 1 60 display a desired web page is 
to activate a hyperlink displayed on the currently dis- 
played page. For example, to go to the home page on 
the Arter & Hadden LLP web site, the user could use the 
pointing device 103 to activate (e.g., click with his 
mouse on) the hyperlink 620. 

[0047] A third way for the user to request that the 
browser application 160 display a desired web page is 
through entry of a keyword into a data entry field in a 
web page displayed in the display pane 210. For exam- 
ple, to search for an attorney with the firm of Arter & 
Hadden LLR the user could use the keyboard 102 to 
type the attorney's last name into the data entry field 
640 and click on the Search button 630. It is well known 
that some data entry fields may be activated by simply 
typing keywords into the data entry field and typing 
Enter, and this is also within the scope of the invention. 
[0048] Other features that are used for the user to 
request a desired web page are within the scope of the 
invention, such as pull-down lists and scroll boxes. It 
should also be appreciated that a displayed web page 
may be a static or a dynamic page. 
[0049] Returning now to the method of Figure 5, in 
the next step, the monitoring application 110 obtains 
identifying information about the requested web page 
(step 530). As mentioned above, there are at least three 
techniques for obtaining information about a requested 
web page, and these techniques are further described 
with respect to Figures 8A, 8B and 8C, respectively. 
[0050] According to the first technique, the client 
monitoring application 110 grabs URLs from the 
address bar. In this technique, after the user requests 
that the browser application 160 display a desired web 
page (step 520), the browser application 160 inserts in 
the address bar the URL corresponding to the web page 
desired by the user (step 810). This is a normal part of 
the operation of browser applications such as Microsoft 
Internet Explorer and Netscape Navigator. 
[0051] With respect to the example of Figure 6, if 
the keyword "sereboff is entered into the data entry field 
640, and the user clicks on the Search button 630, the 
browser application will display a new web page in the 
display pane 210, such as web page 710 shown in Fig- 
ure 7. In both Microsoft Internet Explorer and Netscape 
Navigator, the browser application inserts the new URL 
in the address bar before actually displaying the page 
identified by the URL. As can be seen in Figure 7, the 
browser application has inserted the URL of the dis- 
played web page 710 in the address bar 220. Figure 7 
also shows a new title in the title bar 230 — that of the 
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currently displayed page. Whereas the web page of Fig- 
ure 6 is entitled, "Arter & Hadden LLP — Attorney 
Search" and has the URL www.arterhad- 
den.com/alpha.htm, the web page of Figure 7 is enti- 
tled, "Arter & Hadden LLP — Individual Profile" and has 
the URL www.arterhadden.com/attysearch. gw?s=s ere- 
boff. 

[0052] After the URL has been inserted into the 
address bar (step 810), the client monitoring application 
110 copies the URL from the address bar (step 820). In 
the preferred embodiment, the client monitoring appli- 
cation monitors the title bar 230. This can be done by 
setting an appropriate hook, in the manner known in the 
art. The client monitoring application recognizes if the 
title has changed, and if so, copies the new URL from 
the address bar. Other techniques for recognizing that 
the URL in the address bar have changed are within the 
scope of the invention. 

[0053] According to the second technique for 
obtaining information about a requested web page, the 
client monitoring application 110 grabs URLs from the 
communications stream between the browser applica- 
tion 160 and the web server 150. In this technique, after 
the user requests that the browser application 160 dis- 
play a desired web page (step 520), the browser appli- 
cation 1 60 transmits the URL of the desired web page to 
the web server 150 (step 830). The URL will be availa- 
ble within the local device 100 at a number of software 
and hardware levels, and the client monitoring applica- 
tion 110 can set hooks or create traps at any of these 
'evels as may be desired. After the URL is transmitted 
irom the browser application 160 (step 830), the client 
monitoring application 110 copies the URL from the 
transmission (step 840). 

[0054] According to the third technique for obtaining 
information about a requested web page, the client 
monitoring application 110 grabs information from the 
browser application's display pane 210, or the object 
corresponding to the display pane 210. In this tech- 
nique, after the user requests that the browser applica- 
tion 160 display a desired web page (step 520), client 
monitoring application 110 determines if the displayed 
page (e.g., page 610) includes a data entry field (step 
850). If not, then the client monitoring application 110 
has nothing to do (step 860). However, if the displayed 
web page has a data entry field, then the client monitor- 
ing application 110 determines if the user has entered 
anything in the data entry field (step 870). If the user 
has not entered anything into the data entry field, then 
the client monitoring application 110 has nothing to do 
(step 860). However, if the user has entered keywords 
into the data entry field, then the client monitoring appli- 
cation 1 1 0copies these keywords (step 880). There are 
a number of ways to test if a web page has a data entry 
field, and to copy entered keywords. These include 
screen scraping, parsing web pages received by the 
local device 100, copying keystrokes, etc. If the user 
selects a hyperlink, the client monitoring application 1 10 



can obtain the URL associated with the hyperlink from 
the HTML source of the displayed page having the 
hyperlink. 

[0055] After the client monitoring application 110 

5 obtains the information about the requested web page 
(step 530), the client monitoring application 110 parses 
the copied information, and derives monitoring informa- 
tion from the copied information (step 535). As 
described above, the client monitoring application 110 

io will have grabbed a URL, keywords, or other informa- 
tion. The particular nature of the monitoring information 
is not critical to the present invention. However, in the 
preferred embodiment, the monitoring information is 
used for targeting advertising to the user. Thus, useful 

15 information which is desirable for monitoring includes 
the top level domain name and the second level domain 
name. Other useful information are keywords entered 
by the user into data entry fields. 
[0056] For some URLs, such as search engines, 

20 the keywords are particularly useful. The client monitor- 
ing application 1 1 0 preferably recognizes when the user 
is browsing a search engine, and in such a case grabs 
the search terms (keywords) entered by the user in the 
search box (data entry field). The client, monitoring 

25 application 110 preferably can recognize the major 
search engines from their second level domain names, 
e.g. "yahoo," "excite," "altavista," "lycos," "infoseek* and 
"go". 

[0057] In some embodiments, it might be desirable 

30 for the client monitoring application 1 1 0 to transmits the 
entire URL to the monitoring server 130. 
[0058] With the monitoring information derived 
(step 535), the client monitoring application 110 next 
transmits the monitoring information to the monitoring 

35 server 130 (step 540). In some embodiments, the mon- 
itoring information should be transmitted in a coded or 
secure format. Furthermore, in some embodiments, the 
monitoring information should be transmitted in a batch 
form. The process then loops back to step 520 and con- 

40 tinues until the client monitoring application 110 or the 
browser application 160 is de-activated (e.g., closed). 
[0059] As can be seen, this process permits brows- 
ing by the user, and monitoring of that browsing, without 
interfering with the user's use of the browser applica- 

45 tion. 

[0060] Although exemplary embodiments of the 
present invention have been shown and described, it 
will be apparent to those having ordinary skill in the art 
that a number of changes, modifications, or alterations 
so to the invention as described herein may be made, none 
of which depart from the spirit of the present invention. 
All such changes, modifications and alterations should 
therefore be seen as within the scope of the present 
invention. 

55 

Claims 

1. A method of monitoring web browsing by a user, 
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wherein the user browses by means of a browser 
application on a client computer, the client compu- 
ter comprising a display and an input device, the 
browser application for generating a browser win- 
dow on the display and for requesting web pages, 5 
the browser window including a display pane and 
an address bar, the display pane comprising a first 
region of the browser window wherein the browser 
application causes web pages obtained by the 
browser application to be displayed, the address 10 
bar comprising a second region of the browser win- 
dow through which the browser application displays 
resource locator strings corresponding to displayed 
web pages, the method comprising the steps of: 

15 

(a) activating a client monitoring application on 
the client computer; 

(b) the browser application activating on the cli- 
ent computer; 

(c) the user using the input device and the 20 
browser application to request a first web page 
desired by the user from a web server; 

(d) the browser application displaying a first 
resource locator string corresponding to the 
first web page in the address bar; 25 

(e) the client monitoring application copying the 
first resource locator string from the address 
bar; and 

(f) the client monitoring application transmitting 
monitoring information derived from the copied 30 
resource locator string to a monitoring server; 
whereby browsing by the user is monitored 
without interfering with the user's use of the 
browser application. 

35 

2. The method of monitoring web browsing by a user 
as set forth in claim 1, wherein the input device 
comprises a keyboard, and the method further 
comprises, in the step of the user using the input 
device and the browser application to request the 40 
first web page, the user using the keyboard to enter 
the first resource locator string into the address bar. 

3. The method of monitoring web browsing by a user 

as set forth in claim, wherein the input device com- 45 
prises a pointing device, and the method further 
comprises: 

after the step of the browser application activat- 
ing on the client computer, the browser applica- so 
tion displaying a second web page in the 
display pane, the display pane including a 
hyperlink, wherein the hyperlink is associated 
with the first resource locator string; and 
in the step of the user using the input device 55 
and the browser application to request the first 
web page, the user using the pointing device to 
click on the hyperlink; 



wherein the browser application displays the 
first resource locator string in the address bar 
in response to the user using the mouse to click 
on the hyperlink. 

4. The method of monitoring web browsing by a user 
as set forth in claim 1 , the method further compris- 
ing: 

after the step of the browser application activat- 
ing on the client computer, the browser applica- 
tion displaying a second web page in the 
display pane, the display pane including a data 
entry field; and 

in the step of the user using the input device 
and the browser application to request the first 
web page, the user using the input device to 
enter a keyword into the data entry field; 
whereby the first resource locator string 
includes the keyword. 

5. The method of monitoring web browsing by a user 
as set forth in claim 1 , wherein the web server is 
part of the Internet. 

6. The method of monitoring web browsing by a user 
as set forth in claim 1 , wherein the first resource 
locator string comprises a top level domain name 
and a second level domain name, and wherein the 
monitoring information comprises the top level 
domain name and the second level domain name. 

7. The method of monitoring web browsing by a user 
as set forth in claim 1 , wherein the web server is 
part of an intranet. 

8. A method of monitoring web browsing by a user, 
wherein the user browses by means of a browser 
application on a client computer, the client compu- 
ter comprising a display and an input device, the 
browser application for generating a browser win- 
dow on the display, the browser window including a 
display pane, the browser application further for 
requesting web pages and displaying web pages in 
the display pane, wherein the user causes the 
browser application to request web pages through 
use of the input device, the method comprising the 
steps of: 

(a) activating a client monitoring application on 
the client computer; 

(b) the browser application activating on the cli- 
ent computer; 

(c) the user using the input device to identify to 
the browser application a desired first web 
page; 

(d) the browser application transmitting a first 
resource locator string corresponding to the 
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desired first web page to a first web server; 

(e) the client monitoring application copying the 
first resource locator string from the transmis- 
sion by the browser application of the first 
resource locator string to the first web server; s 
and 

(f) the client monitoring application transmitting 
monitoring information derived from the copied 
first resource locator string to a monitoring 
server; 10 
whereby browsing by the user is monitored 
without interfering with the user's use of the 
browser application. 

The method of monitoring web browsing by a user 15 
as set forth in claim 8, 

wherein the browser window further includes 
an address bar, the address bar comprising a sec- 
ond region of the browser window through which 
the browser application receives resource locator 20 
strings entered by the user, and the resource loca- 
tor strings entered by the user correspond to web 
pages which the user desires to be displayed in the 
display pane; 

25 

the method further comprising, in the step of 
the user using the input device to identify to the 
browser application the desired first web page, 
the user entering the first resource locator 
string into the address bar. 30 

The method of monitoring web browsing by a user 
as set forth in claim 8, wherein the input device 
comprises a pointing device, and the method fur- 
ther comprises, 35 

after the step of the browser application activat- 
ing on the client computer, the browser applica- 
tion displaying a second web page in the 
display pane, the display pane including a 40 
hyperlink, wherein the hyperlink is associated 
with the first resource locator string; and 
in the step of the user using the input device 
and the browser application to request the first 
web page, the user using the pointing device to 45 
click on the hyperlink; 

wherein the browser application displays the 
first resource locator string in the address bar 
in response to the user using the mouse to click 
on the hyperlink. so 

The method of monitoring web browsing by a user 
as set forth in claim 8, the method further compris- 
ing: 



55 



(a) after the step of the browser application 
activating on the client computer, the browser 
application displaying a second web page, 



wherein the second web page includes a data 
entry field; 

(b) in the step of the user using the input device 
to identify to the browser application the 
desired first web page, the user using the input 
device to enter a keyword into the data entry 
field; 

(c) in the step of the browser application trans- 
mitting the first string to the web server, the first 
resource locator string including the keyword; 

(d) in the step of the client monitoring applica- 
tion transmitting the monitoring information, the 
monitoring information identifying the keyword. 

12. The method of monitoring web browsing by a user 
as set forth in claim 1 1 , 

after the step of the client monitoring applica- 
tion copying the first resource locator string, the 
client monitoring application testing whether 
the first resource locator string includes a pre- 
defined second string; 

if the first resource locator string includes the 
predefined second string, then the client moni- 
toring application parsing the first resource 
locator string and deriving the keyword from 
the first resource locator string, and otherwise 
omitting the step of the identifier identifying the 
keyword. 

13. The method of monitoring web browsing by a user 
as set forth in claim 0, wherein the source of web 
pages comprises the Internet. 

14. The method of monitoring web browsing by a user 
as set forth in claim 8, wherein the first resource 
locator string comprises a top level domain name 
and a second level domain name, and wherein the 
monitoring information transmitted by the client 
monitoring application comprises the. top level 
domain name and the second level domain name. 

15. The method of monitoring web browsing by a user 
as set forth in claim 8, wherein the source of web 
pages comprises an intranet. 

16. A method of monitoring web browsing by a user, 
wherein the user browses by means of a browser 
application on a client computer, the client compu- 
ter comprising a display and an input device, the 
browser application for generating a browser win- 
dow on the display, the browser window including a 
display pane, the browser application further for 
requesting web pages and displaying web pages in 
the display pane, wherein the user causes the 
browser application to request web pages through 
use of the input device, the method comprising the 
steps of: 
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(a) activating a client monitoring application on 
the client computer; 

(b) the browser application activating on the cli- 
ent computer; 

(c) the browser application receiving a first web 5 
page from a first web server, the first web page 
comprising a data entry field; 

(d) the browser application displaying the first 
web page in the display pane; 

(e) the user using the input device to enter a 10 
keyword into the data entry field; 

(f) the client monitoring application copying the 
keyword from the displayed first web page; and 

(g) the client monitoring application transmit- 
ting an identifier of the keyword to a predeter- is 
mined server; 

whereby browsing by the user is monitored 
without interfering with the user's use of the 
browser application. 

20 

17. The method of monitoring web browsing by a user 
as set forth in claim 16, wherein the identifier com- 
prises the keyword. 

18. The method of monitoring web browsing by a user 25 
as set forth in claim 16, wherein the first web page 
has associated therewith a first resource locator 
string, the method further including the steps of: 



if the first resource locator string includes the 
predefined second string, then performing the 35 
step of the client monitoring application copy- 
ing the keyword from the displayed first web 
page, and otherwise omitting the steps of the 
client monitoring application copying the key- 
word and transmitting the identifier of the key- 40 
word. 

19. The method of monitoring web browsing by a user 
as set forth in claim 1 8, wherein the first web server 
includes a search engine and the predefined sec- 45 
ond string identifies the search engine. 

20. The method of monitoring web browsing by a user 
as set forth in claim 1 9, wherein the predefined sec- 
ond string is selected from the group consisting of: so 
"yahoo," "excite," "altavista," "lycos," "infoseek" and 

21. A method of monitoring a user's usage of the Inter- 
net using a client monitoring application on a local 55 
device, the local device including an input device 
and an output device, the local device accessing 

the internet and providing interaction with the Inter- 



net using a browser application operative on the 
local device, the browser application for generating 
a browser window on the output device and for 
requesting web pages, the browser window includ- 
ing a display pane and an address bar, the display 
pane comprising a first region of the browser win- 
dow wherein the browser application causes web 
pages obtained by the browser application to be 
displayed, the address bar comprising a second 
region of the browser window through which the 
browser application displays resource locator 
strings corresponding to displayed web pages in 
the display pane, the method comprising the steps 
of: 

(a) the user causing the local device to connect 
to a web server; 

(b) the client monitoring application establish- 
ing a communication link to a monitoring 
server; 

(c) the client monitoring application transmitting 
identifying information to the monitoring server; 

(d) the user identifying to the browser applica- 
tion a first web page desired by the user into 
the browser window's address bar using the 
input device wherein a first resource locator 
string is associated with the first web page; 

(e) the client monitoring application copying the 
first resource locator string from the address 
bar; and 

(f) the client monitoring application deriving 
monitoring information from the first resource 
locator string, the monitoring information com- 
prising at least a part of the first resource loca- 
tor string; and 

(g) the client monitoring application transmit- 
ting the monitoring information to the monitor- 
ing server. 

22. The method of monitoring a user's usage of the 
Internet using a client monitoring application on a 
local device of claim 21 , wherein the first resource 
locator string includes a second level domain name 
and the monitoring information includes the second 
level domain name. 

23. The method of monitoring a user's usage of the 
Internet using a client monitoring application on a 
local device of claim 21 , wherein the client monitor- 
ing application transmits the monitoring information 
to the monitoring server in a coded format 

24. A method of monitoring a user's usage of the Inter- 
net using a client monitoring application on a local 
device, the local device including an input device 
and an output device, the local device accessing 
the Internet and providing interaction with the Inter- 
net using a browser application operative on the 



the client monitoring application testing 30 
whether the first resource locator string 
includes a predefined second string; 



55 



10 



BNSDOCID: <EP 1045547A2J_> 



19 



EP 1 045 547 A2 



20 



local device, the method comprising the steps of: 

(a) the user causing the local device to connect 
to a first web server; 

5 

(b) the client monitoring application establish- 
ing a communication link to a monitoring 
server; 

(c) the client monitoring application transmitting 10 
identifying information to the monitoring server; 

(d) the user using the input device, the output 
device and the browser application to interact 
with the first web server, wherein the browser is 
application transmits resource locator strings to 

the first web server to request specific data 
from the first web sewer; 

(e) concurrently with the user interacting with 20 
the first web server, the client monitoring appli- 
cation monitoring the resource locator strings 
transmitted to the first web server; 

(f) the client monitoring application deriving 2s 
monitoring information from each such 
resource locator string; and 

(g) the client monitoring application transmit- 
ting the monitoring information to the monitor- 30 
ing server string. 



25. The method of monitoring a user's usage of the 
Internet using a client monitoring application on a 
local device of claim 24, wherein the resource loca- 35 
tor string includes a second level domain name and 
the monitoring information includes the second 
level domain name. 



(c) the client monitoring application transmitting 
identifying information to the monitoring server; 

(d) the browser application displaying a first 
web page in the display pane, the first web 
page comprising a data entry field; 

(e) the user using the input device to enter a 
keyword into the data entry field; 

(f) the browser application transmitting a first 
resource locator string to the first web server, 
wherein the first resource locator string 
includes the keyword; 

(g) the client monitoring application copying the 
first resource locator string from the transmis- 
sion by the browser application of the first 
resource locator string to the first web server; 
and 

(h) the client monitoring application testing 
whether the first resource locator includes a 
predefined second string; and 

(i) if the first resource locator string includes the 
predefined second string, then: 

(1) the client monitoring application pars- 
ing the first resource locator string and 
deriving the keyword from the first 
resource locator string; and 

(2) the client monitoring application trans- 
mitting monitoring information to the moni- 
toring server, the monitoring information 
comprising at least a part of the first 
resource locator string. 

28. The method of monitoring a user's usage of the 
Internet using a client monitoring application on a 
local device of claim 27, wherein the first resource 
locator string includes a second level domain name 
and the monitoring information includes the second 
level domain name. 



26. The method of monitoring a user's usage of the 40 
Internet using a client monitoring application on a 
local device of claim 24, wherein the client monitor- 
ing application transmits the monitoring information 

to the monitoring server in a coded format. 

45 

27. A method of monitoring a user's usage of the Inter- 
net using a client application on a local device, the 
local device including an input device and an output 
device, the local device accessing the Internet and 
providing interaction with the Internet using a 50 
browser application operative on the local device, 

the method comprising the steps of: 



29. The method of monitoring a user's usage of the 
Internet using a client monitoring application on a 
local device of claim 27, wherein the client monitor- 
ing application transmits the monitoring information 
to the monitoring server in a coded format. 

30. The method of monitoring a user's usage of the 
Internet using a client monitoring application on a 
local device of claim 27, wherein the web server 
includes a search engine and the predefined sec- 
ond string identifies the search engine. 

31. The method of monitoring a user's usage of the 
Internet using a client monitoring application on a 
local device of claim 30, wherein the second string 
includes a second level domain name selected from 
the group consisting of: "yahoo," "excite," 
"aftavista," "lycos," "infoseek" and "go." 



(a) the user causing the local device to connect 

to a first web server; 55 

(b) the client monitoring application establish- 
ing a communication link to a monitoring 
server; 



11 



BNSDOCID: <EP 1045547A2_I_> 



21 



EP 1 045 547 A2 



22 



32. A local device comprising a display and an input 
device for providing browsing to a user by means of 
a browser application on a client computer, and fur- 
ther for monitoring web browsing by the user by 
means of a client application, 5 

(a) the browser application comprising compu- 
ter readable program code and operative on 
the local device for generating a browser win- 
dow on the display and for requesting web 10 
pages, the browser window including a display 
pane comprising a first region of the browser 
window wherein the browser application 
causes web pages obtained by the browser 
application to be displayed, the displayed web is 
pages having associated therewith respective 
resource locator strings, the browser applica- 
tion defining an address bar object in which, at 
any given time, the browser application stores 

the resource locator string corresponding to 20 
the then-displayed web page, the browser 
application comprising computer readable pro- 
gram code for causing the local device to: 

(1 ) accept a request by the user, using the 25 
input device, for the browser application to 
display a first web page from a web server; 

(2) request the first web page from the web 
server; 

(3) receive the first web page from the web 30 
server; 

(4) display the first web page in the display 
pane; 

(5) store in the address bar a first resource 
locator string corresponding to the first 35 
web page; 

(b) the client application comprising computer 
readable program code for causing the local 
device to: 40 

(1) obtain the first resource locator string 
from the address bar object; 

(2) derive monitoring information from the 
first resource locator string; 45 

(3) transmit the monitoring information to a 
monitoring server; 

whereby browsing by the user is monitored 
without interfering with the user's use of the so 
browser application. 

33. The local device as set forth in claim 32 wherein the 
input device comprises a keyboard, the browser 
application further comprises an address bar com- 55 
prising a second region of the browser window in 
which the browser application displays the resource 
locator string corresponding to the ten -displayed 



web page, the browser application further com- 
prises computer readable program code for causing 
the local device to accept from the keyboard the 
user's entry of the first resource locator string into 
the address bar. 

34. The local device as set forth in claim 32, wherein 
browser application includes computer readable 
program code for causing the local device to 

display a second web page in the display pane, 
the displayed web page including a data entry 
field; and 

accepting the user's entry of a keyword using 
the input device into the data entry field; 
wherein the first resource locator string 
includes the keyword. 

35. The local device as set forth in claim 32, wherein 
the web server is part of the Internet. 

36. The local device as set forth in claim 35, wherein 
the first resource locator string comprises a top 
level domain name and a second level domain 
name, and wherein the monitoring information com- 
prises the top level domain name and the second 
level domain name. 

37. The local device as set forth in claim 32, wherein 
the web server is part of an intranet. 

38. The local device as set forth in claim 32, the client 
monitoring application further comprising computer 
readable program code for causing the local device 
to: 

establish a communication link to the monitor- 
ing server; and 

transmit information identifying the user to the 
monitoring server. 

39. The local device as set forth in claim 32, the client 
monitoring application further comprising computer 
readable, program code for encoding the monitor- 
ing information prior to transmitting the monitoring 
information to the monitoring server. 

40. A computer program product comprising a compu- 
ter usable medium having a client monitoring appli- 
cation comprising computer readable program 
code embodied therein for monitoring web brows- 
ing by a user of a local device, the user browsing on 
the local device by means of a browser application, 
the local device comprising a display and an input 
device, the browser application for generating a 
browser window on the display and for requesting 
and displaying web pages, wherein the displayed 
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web pages have associated therewith respective 
resource locator strings, the browser application 
defining an address bar object in which, at any 
given time, the browser application stores the 
resource locator string corresponding to the then- 
displayed web page, the client monitoring applica- 
tion comprising computer readable code for operat- 
ing the local device to: 

(a) receive from the user information identifying 
the user to the monitoring server; 

(b) transmit the identifying information to the 
monitoring server to thereby establish a ses- 
sion with the monitoring server; 

(c) obtain a first resource locator string from the 
address bar object of the browser application; 

(d) derive monitoring information from the first 
resource locator string; and 

(e) transmit the monitoring information to the 
monitoring server. 

41. The computer program product comprising a com- 
puter usable medium having a client monitoring 
application for monitoring web browsing by a user 
of a local device as set forth in claim 40, wherein 
the first resource locator string comprises a URL. 

42. The computer program product comprising a com- 
puter usable medium having a client monitoring 
application for monitoring web browsing by a user 
of a local device as set forth in claim 41 , wherein 
the monitoring information comprises a top level 
domain name and a second level domain name. 



monitoring server;. 

44. The computer program product comprising a com- 
puter usable medium having a client monitoring 

5 application for monitoring web browsing by a user 

of a local device as set forth in claim 40, wherein 
the client monitoring application transmits the mon- 
itoring information to the monitoring server in a 
coded format. 

10 

45. A local device comprising the computer program 
product comprising a computer usable medium 
having a client monitoring application of claim 40. 



43. The computer program product comprising a com- 
puter usable medium having a client monitoring 
application for monitoring web browsing by a user 
of a local device as set forth in claim 40, wherein 
the resource locator strings for at least some of the 
displayed web pages include keywords, the client 
monitoring application further including computer 
readable code for operating the local device to: 

receive from the monitoring server a match 
string; 

test whether the first resource locator string 
includes the match string; 
if the first resource locator string includes the 
match string, then: 

test whether the resource locator string 
includes a keyword, 

if the resource locator string includes a 
keyword, then: 

obtain the keyword from the first 

resource locator string; 

transmit the obtained keyword to the 
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(54) Monitoring of individual internet usage 

(57) Disclosed is a device and method in which the 
on-line activities of an on-line user are monitored and 
stored. Information regarding the user's activities are 
used as a basis for targeting advertisements to the user 
Monitoring is performed by a client monitoring applica- 
tion, which performs monitoring without intruding on the 
user's activities. According to one aspect of the inven- 



tion, URLs in the address bar of the browser application 
are obtained by the client monitoring application. Ac- 
cording to another aspect of the invention, the stream 
of URLs transmitted by the browser application are ob- 
tained by the client monitoring application. According to 
another aspect of the invention, information in displayed 
web pages is obtained by the client monitoring applica- 
tion. 
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